Ilaalinta xogtayada onlaynka weligeed ma noqon doonto hawl fudud, gaar ahaan maalmahan marka weeraryahannadu ay si joogto ah u hindisaan farsamooyin cusub oo ay uga faa'iidaystaan ​​si ay u xadaan xogtaada. Mararka qaarkood weerarradoodu ma noqon doonaan kuwo waxyeello u leh isticmaaleyaasha gaarka ah. Laakin weerarrada baaxadda leh ee lagu qaado qaar ka mid ah mareegaha caanka ah ama xog-ururinta maaliyadeed waxay noqon karaan khatar aad u weyn. Inta badan, weeraryahanadu waxay marka hore isku dayaan inay ku riixaan qaar ka mid ah malware-ka mashiinka isticmaalaha. Mararka qaarkood farsamadani ma shaqaynayso, si kastaba ha ahaatee.

Isha sawirka: Kaspersky.

Waa maxay Weerarka Dhexe ee Nin-ku-jirta

Habka caanka ah waa  weerarka Man-In-The-Dhexe^{(Man-In-The-Middle attack)} . Waxa kale oo loo yaqaan  weerarka guutada baaldiga^{(bucket brigade attack)} , ama mararka qaarkood  Janus ayaa^{(Janus attack)}  ku weerara cryptography. Sida magaceedu ka muuqata, weeraryahanku waxa uu naftiisa ku hayaa laba dhinac, taas oo ka dhigaysa in ay rumaystaan ​​in ay si toos ah uga wada hadlayaan xidhiidh gaar ah, marka dhab ahaantii sheekada oo dhan uu maamulo weerarka.

Weerarka dhex-dhexaadka ah waxa uu guulaysan karaa oo keliya marka uu weeraryahanku sameeyo hubsasho wadajir ah oo ka dhexeeya laba dhinac. Inta badan borotokoollada qarsoodiga ah waxay had iyo jeer bixiyaan nooc ka mid ah xaqiijinta barta dhamaadka, gaar ahaan si loo joojiyo weerarada MITM ee isticmaalayaasha. Hab-maamuuska Secure Sockets Layer (SSL)^{(Secure Sockets Layer (SSL))} ayaa had iyo jeer loo adeegsadaa in lagu xaqiijiyo hal ama labada dhinac iyadoo la adeegsanayo awood shahaado la isku halleyn karo.

Sida ay u shaqeyso

Aynu nidhaahno waxaa sheekadan ku jira saddex jilayaal: Mike , Rob , iyo Alex . Mike wuxuu rabaa inuu la xiriiro Rob . Dhanka kale, Alex (weeraryahan) wuxuu joojiyaa wada hadalka si uu u dhegeysto oo uu u qaado sheeko been abuur ah Rob , oo wakiil ka ah Mike . Marka hore^(First) , Mike waxa uu ^(Mike)Rob waydiistay furihiisa dadweynaha. Haddii Rob uu bixiyo furihiisa Mike , Alex wuu soo dhexgalay, tanina waa sida "weerarka dhex-dhexaadka ah" uu ku bilaabmayo. Alex ayaa markaa fariin been abuur ah u diray Mikekaas oo sheeganaya inuu ka yimid Rob laakiin ay ku jiraan furaha guud ee Alex . Mike si sahal ah ayuu u aaminsan yahay in furaha la helay uu leeyahay Rob marka taasi aysan run ahayn. Mike isagoon waxba galabsanin wuxuu fariintiisa ku sireeyay furaha Alex wuxuuna fariintii loo rogay dib ugu soo celiyaa ^(Alex)Rob .

Weerarada MITM^(MITM) ee ugu caansan , qofka wax weeraray ayaa inta badan isticmaala router WiFi si uu u dhexgalo isgaadhsiinta isticmaalaha. Farsamadan waxa lagu shaqayn karaa iyada oo laga faa'iidaysto router leh barnaamijyo xaasidnimo leh si ay u dhexgalaan fadhiyada isticmaalaha ee router-ka. Halkan, weeraryahanku wuxuu marka hore u habeeyaa laptop-kiisa sidii meel WiFi ah , isaga oo dooranaya magaca inta badan lagu isticmaalo goobaha caamka ah, sida garoonka diyaaradaha ama dukaanka qaxwaha. Marka isticmaaluhu ku xidho router-kaas xaasidka ah si uu u gaadho mareegaha sida goobaha bangiyada onlaynka ah ama goobaha ganacsiga, weeraryahanku waxa uu markaa diiwaan galinayaa aqoonsiga isticmaalaha si uu hadhow u isticmaalo.

Kahortagga weerarka iyo agabka nin-ku-dhex-dhexaadka ah

Inta badan difaacyada waxtarka leh ee MITM waxaa laga heli karaa oo keliya router-ka ama dhinaca server-ka. Ma yeelan doontid wax xakameyn gaar ah oo ku saabsan amniga wax kala iibsigaaga. Taa baddalkeeda, waxaad isticmaali kartaa sir adag oo u dhexeeya macmiilka iyo serverka. Xaaladdan oo kale, server-ku wuxuu xaqiijinayaa codsiga macmiilka isagoo soo bandhigaya shahaadada dhijitaalka ah, ka dibna xiriirka kaliya ayaa la dhisi karaa.

Habka kale ee looga hortagayo weerarrada MITM -yada noocan oo kale ah ayaa ah, in aan waligaa la xidhin si toos ah loo furo router- yada WiFi^(WiFi) . Haddii aad rabto, waxaad isticmaali kartaa biraawsarkaaga fur-in sida HTTPS Everywhere ama ForceTLS . Furayaashan ayaa kaa caawin doona inaad samaysato xiriir sugan mar kasta oo ikhtiyaarka la heli karo.

Akhri marka xigta^{(Read next)} : Waa maxay weerarrada Man-in-the-Browser^{(Man-in-the-Browser attacks)} ?

What is Man-In-The-Middle Attack (MITM): Definition, Prevention, Tools

Protecting our data online is never goіng to be an easy task, especially nowadays when attackers are regularly invеnting some new teсhniques and explоits to steal yoυr data. Sometimes their аttacks will not be sо harmful to individual users. But large-scale attacks on some popular websites or financial databases could be highly dangеrous. In most cases, the attackers first try to push some malware on to usеr’ѕ maсhine. Sometimes this technique doesn’t work out, however.

Image source: Kaspersky.

What is Man-In-The-Middle Attack

A popular method is Man-In-The-Middle attack. It is also known as a bucket brigade attack, or sometimes Janus attack in cryptography. As its name suggests, the attacker keeps himself/herself between two parties, making them believe that they are talking directly to each other over a private connection, when actually the entire conversation is being controlled by the attacker.

A man-in-the-middle attack can be successful only when the attacker forms a mutual authentication between two parties. Most cryptographic protocols always provide some form of endpoint authentication, specifically to block MITM attacks on users. Secure Sockets Layer (SSL) protocol is always being used to authenticate one or both parties using a mutually trusted certification authority.

How it works

Let’s say there are three characters in this story: Mike, Rob, and Alex. Mike wants to communicate with Rob. Meanwhile, Alex (attacker) inhibits the conversation to eavesdrop and carries on a false conversation with Rob, behalf on Mike. First, Mike asks Rob for his public key. If Rob provides his key to Mike, Alex intercepts, and this is how “man-in-the-middle attack” begins. Alex then sends a forged message to Mike that claims to be from Rob but including Alex’s public key. Mike easily believes that the received key does belong to Rob when that’s not true. Mike innocently encrypts his message with Alex’s key and sends the converted message back to Rob.

In the most common MITM attacks, the attacker mostly uses a WiFi router to intercept the user’s communication. This technique can be work out by exploiting a router with some malicious programs to intercept user’s sessions on the router. Here, the attacker first configures his laptop as a WiFi hotspot, choosing a name commonly used in a public area, such as an airport or coffee shop. Once a user connects to that malicious router to reach websites such as online banking sites or commerce sites, the attacker then logs a user’s credentials for later use.

Man-in-the-middle attack prevention & tools

Most of the effective defenses against MITM can be found only on the router or server-side. You won’t be having any dedicated control over the security of your transaction. Instead, you can use strong encryption between the client and the server. In this case, the server authenticates the client’s request by presenting a digital certificate, and then the only connection could be established.

Another method to prevent such MITM attacks is, to never connect to open WiFi routers directly. If you wish to so, you can use a browser plug-in such as HTTPS Everywhere or ForceTLS. These plug-ins will help you in establishing a secure connection whenever the option is available.

Read next: What are Man-in-the-Browser attacks?

Related posts

• Maqaalka Amniga Internetka iyo talooyinka isticmaalayaasha Windows

• 5-ta ugu Fiican ee ku darida Qarsoonnimada Firefox ee Badbaadada Intarneedka

• Talooyin, Qalab & Adeegyo Maareynta Sumcada ee khadka tooska ah

• Sida loo hubiyo in xiriirku uu badbaado yahay ama aan la isticmaalin biraawsarkaaga

• Soo ogow in akoonkaaga onlaynka ah la jabsaday & iimaylka & faahfaahinta sirta ah oo la daatay

• Qaababka Madow: Khiyaamooyinka Mareegta, Tusaalooyinka, Noocyada, Sida Loo Arko & Iska Ilaali

• Waa maxay Pharming sideese uga hortagi kartaa Khayaanada Intarneedka ah?

• 7 siyood oo ASUS Control Parental Control ay u ilaaliso caruurtaada

• Waa maxay Farta Taraafiga ee Mareegta? Sidee loo ilaaliyaa naftaada?

• Talooyin ku saabsan sidii aad ugu ilaalin lahayd kombuyuutarrada dadweynaha

• Weerarada Cyber ​​- Qeexid, Noocyada, Ka Hortagga

• Talooyin Badbaadada onlaynka ah ee Carruurta, Ardayda iyo Dhallinyarada

• 4+ Qalab bilaash ah oo loogu talagalay samaynta isku xirka fog ee Mac ilaa PC-yada Windows

• Waa maxay khiyaanada Whaling & sida loo ilaaliyo ganacsigaaga

• 10-ka ugu caansan ee Online-ka ah, Internet-ka iyo iimaylka iyo been-abuurka

• Aaladaha Shirarka Fiidiyowga ee khadka tooska ah ee bilaashka ah ee ugu fiican AAN IS DIIWAAN GELIN

• Aaladaha Samaynta Jadwalka Socodka ee Bilaashka ah ee ugu Fiican

• Khayaanada Microsoft: Khiyaanada Taleefanka & iimaylka ee si khaldan u isticmaala Magaca Microsoft

• Aaladaha Kormeerka Bandwidth ee Bilaashka ah ee ugu Fiican Windows 11/10

• Maamulaha soo dejinta Internetku ma kordhiyaa xawaaraha soo dejinta?